Legal
Privacy policy
Last updated 7 September 2026.
Who we are
Velora Systems is a sole proprietorship trading in South Africa, operating from 81 Botterklapper, Fintech Campus, The Willows, 0081, South Africa. For the purposes of the Protection of Personal Information Act 4 of 2013 ("POPIA") we are the responsible party for the personal information described here. For the purposes of the UK and EU General Data Protection Regulation we act as a controller in respect of that same information.
Contact Information Officer, Velora Systems at info@velorasystems.net.
What we collect
| Category | Where it comes from | Why we hold it |
|---|---|---|
| Name, email address, telephone number, employer | You, when you contact us or engage us | To reply to you and to perform our contract with you |
| Your website address and the publicly available content of those pages | You, or public sources | To carry out the accessibility audit you asked for |
| Billing details and invoice records | You, and our payment provider | To take payment and to meet tax and record-keeping obligations |
| Correspondence | You | To maintain a record of what was agreed |
Optional website analytics
With your permission, this website uses Google Analytics, connected to our Firebase project, to understand page visits, referral sites, pricing interest, scanner use and help-link clicks. Analytics receives technical information such as browser and device details, approximate location and a cookie identifier. Google processes network information needed to receive these requests. We do not send entered store addresses, scan results, email addresses, product content or form entries as analytics events. Page addresses sent by our tracking code exclude query strings and fragments.
Google Analytics loads only after you choose Allow analytics. Choosing No thanks keeps it off. We remember this choice in your browser for 180 days. Analytics cookies are also limited to 180 days by our tag configuration. Use Analytics preferences in the footer to change your choice; withdrawing consent stops further tracking and clears this site's analytics cookies. Clearing browser storage lets you make a new choice.
Analytics is optional and the scanner works without it. We do not enable advertising personalization or Google signals. The embedded Shopify app and reviewer demonstration page do not include this website analytics tag. Google may process analytics data outside South Africa; see Google's privacy policy and Google Analytics data practices.
Our public scanner reads publicly available storefront pages. In the Shopify app, a merchant may provide a storefront password to scan their password-protected storefront. We do not request access to Shopify customer or order records.
Data used by the Shopify app
When you open Velora in Shopify admin, the app uses Shopify session tokens and app access tokens to authenticate requests. It reads your shop domain, development-store status and app subscription to provide the selected plan. For image review it reads product identifiers, titles, image previews and existing alt text. It sends approved image descriptions back to Shopify only when you request an update.
The storefront scanner processes page content and, if supplied, your storefront password for the requested scan. When you request an image-based draft, the selected image content and product title are sent to Google Cloud Vertex AI for image understanding. The app uses Shopify and Google Cloud to deliver these functions.
The app stores your latest 200 image changes, including previous descriptions and product identifiers, and your latest 10 scan results in Google Cloud Firestore. It caches up to 300 image drafts and stores usage counts to enforce plan limits. Image files are processed for drafting rather than saved in the app history. These app records are removed when Shopify sends the shop-redaction request after uninstall. App access tokens and plan information are held in server memory. Operational hosting logs can contain shop domains, scan counts, timings and error messages. Shopify retains the product image alt text that you approve.
To request access, correction or deletion of information held by Velora, contact info@velorasystems.net. Shopify's required privacy webhooks are supported. Uninstalling the app does not remove alt text you previously approved in Shopify.
Our lawful basis
- Performance of a contract. To provide the app features and storefront checks you request.
- Legitimate interests. To maintain operational records and respond to app problems.
- Legal obligation. To retain invoices and tax records as South African law requires.
- Consent. Where we rely on it, you may withdraw it at any time.
Direct marketing
We do not send unsolicited electronic marketing to recipients in South Africa. Section 69 of POPIA does not permit it without prior consent, and we comply with that.
Where we contact businesses in other jurisdictions, every message identifies us, states why you received it, gives a postal address and offers a simple way to opt out. If you ask us not to contact you again, we record that and we do not.
Who we share it with
We do not sell personal information and we do not share it for anyone else's marketing. We use a small number of service providers who process information on our behalf, including Shopify for app billing, Google Cloud for hosting and image drafting, our email provider and, when you consent, Google Analytics. Each is bound to process it only on our instructions.
Some of these providers are outside South Africa. Where information is transferred across borders we satisfy ourselves that it is subject to protection substantially similar to POPIA, as section 72 requires.
How long we keep it
- Enquiries that do not become work: up to 12 months.
- App drafts, change history and scan reports: the rolling limits and uninstall deletion described above apply.
- Invoices and tax records: 5 years, as required by South African tax law.
- Opt-out records: kept indefinitely, because that is the only way to honour the request.
Your rights
Under POPIA and, where it applies to you, the GDPR, you may:
- ask what personal information we hold about you and get a copy;
- ask us to correct or delete it;
- object to our processing it, including for direct marketing;
- ask us to restrict how we use it;
- ask for it in a portable format;
- withdraw consent where we relied on consent.
Email info@velorasystems.net and we will respond within 30 days. There is no charge.
Complaints
If you are unhappy with how we have handled your information, please tell us first. You also have the right to complain to the Information Regulator of South Africa, at the Regulator’s published contact channels, or to your own supervisory authority if you are in the UK or EU.
Security
We keep personal information on encrypted devices and in reputable hosted services protected by strong authentication. Access is limited to those who need it, which for a business of this size means the owner. No system is perfectly secure, and we will notify you and the Regulator without undue delay if a breach affects you.
Changes
If we change this policy we will update the date above. Material changes affecting existing clients will be notified by email.